MEDIUM

CVE-2018-19580

Gitlab GitLab 2019-07-10 CVSS v3.0

CVSS

5.3

Description

All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made.

Summary dbcve.org

GitLab versions prior to 11.5.1, 11.4.8, and 11.3.11 have a missing notification feature where changing a user's email address does not trigger a confirmation email to the old email address. This allows account email changes to go unnoticed by the legitimate account owner, potentially enabling account takeover attempts to persist undetected.

Mitigation

Upgrade GitLab to version 11.5.1, 11.4.8, or 11.3.11 or later to receive the missing email notification to the old address on email changes.

Weakness (CWE)

CWE-20 Improper Input Validation

EPSS Score

0.99%

Probability of exploitation in next 30 days

61th percentile

References

https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/39809 Issue Tracking, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE